# MCP overview

file.rocks ships a production [Model Context Protocol](https://modelcontextprotocol.io) server so agents can list buckets, search files, and ask the bucket agent without hand-rolling HTTP.

## Endpoint

```
https://www.file.rocks/api/mcp
```

Streamable HTTP (stateless). Authenticate every request with your API key.

## Security model

- **Bearer API keys only** this pass (no OAuth / CIMD client flow yet)
- Same dogfood gate as REST intelligence APIs
- Per-tool scope checks identical to `/api/v1`
- Optional `bucketIds` allowlist on the key

Never put a live key in a public repo. Prefer client secret stores / env vars.

## Why MCP

Agents get typed tools (`list_files`, `ask_agent`, …) instead of scraping docs for curl. Docs are also exposed as MCP resources so clients can pull markdown context.

## Next

1. [Install](/docs/mcp/install) — Cursor / Claude / generic
2. [Tools](/docs/mcp/tools) — catalog
3. [Auth & scopes](/docs/mcp/auth)

REST remains available: [API overview](/docs/api).